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Attorney's Docket No. 022 
IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re Patent Application of 



Jean-Sebastien CORON 

Application No.: Unassigned 

Filed: September 26, 2001 

For: COUNTERMEASURE 
PROCEDURES IN AN 
ELECTRONIC COMPONENT 
IMPLEMENTING AN ELLIPTICAL 
CURVE TYPE PUBLIC KEY 
ENCRYPTION ALGORITHM 



Group Art Unit: Unassigned 
Examiner: Unassigned 



Assistant Commissioner for Patents 
Washington, D.C. 20231 

Sir: 

Prior to examination and the calculation of filing fees, kindly amend the above- 
identified application as follows: 

IN THE SPECIFICATION: 

Page 1, immediately following the title appearing on lines 1-3, insert the following: 
-This disclosure is based upon French Application No. 99/03921, filed on March 

26, 1999 and International Application No. PCT/FR00/00603, filed March 13, 2000, 

which was published on October 5, 2000 in a language other than English, the contents of 

which are incorporated herein by reference. 

Background of the Invention - 
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Page 11, between lines 21 and 22, insert the following heading: 
- Descript ion of the Invention - 

Add the following Abstract: 

--Elliptical curve based cryptographic algorithms are public key algorithms offering 
a shorter calculation time and smaller key sizes in comparison with RSA. In a smart card 
type environment, these algorithms are vulnerable to differential power analysis (DPA) 
attacks. The disclosed invention provides a countermeasure procedure enabling positive 
action to be taken against DPA -type attacks. The countermeasure does not reduce 
performance and is easy to use in a smartcard type component. - 

IN THE CLAIMS; 

Kindly replace claims 1-13, as follows. 

1 . (Amended) A countermeasure method in an electronic component 
implementing an elliptical curve type public key encryption algorithm, wherein a point P on 
the elliptical curve is represented by the projective coordinates (X, Y, Z) such that x=X/Z 
and y=Y/Z^3, x and y being the coordinates of the point on the elliptical curve in terms of 
affine coordinates, said curve comprising n elements and being defined on a finite field 
GF(p), where p is a prime number and the curve has the equation y^2 = x^3 4-a*x+b, or 
defined on a finite field GF(2 A n), with the curve having the equation 
y^2+x*y=x A 3+a*x^2+b, where a and b are integer parameters, the method comprising 
the steps of: 
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1) Drawing at random an integer 1 such that 0 < 1< p; 

2) For a point P represented by projective coordinates (XI, Yl, Zl), 
calculating X'l=r2*Xl, Y'l=r3*Yl and Z'1=1*Z1, to define the coordinates of the 
point P' = (X'l,Y'l,Z'l); and 

3) Calculating an output point Q=2*P' that is represented by projective 
coordinates (X2, Y2, Z2). 

2. (Amended) A countermeasure method according to Claim 1, wherein the 
elliptical curve is defined on the finite field GF(p), and the step of calculating Q includes 
the following steps: 

Calculate M = 3*X'1^2+a*Z'1^4; 

Calculate Z2=2*Y'l*Z'l; 

Calculate S=4*X'1*Y'1"2; 

Calculate X2=M"2-2*S; 

Calculate T = 8*Y'1*4; and 

Calculate Y2=M*(S-X2)-T. 



3. (Amended) A countermeasure method according to Claim 1, wherein the 
elliptical curve is defined on the finite field GF(p), and further including the following 
steps: 

Drawing at random a non-zero integer 1 of GF(2^n); 
Replacing X0 with 1"2*X0, Y0 with T3*Y0 and Z0 with 1*Z0; 
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Drawing at random a non-zero integer m of GF(2^n); 

Replacing XI with m"2*Xl, Yl with m^3*Yl and Zl with m*Zl; and 

Calculating R=P+Q. 

4. (Amended) A countermeasure method according to Claim 1, further 
including the calculation of the projective coordinates of the point R=(X2,Y2,Z2) such that 
R=P+Q with P=(X0,Y0,Z0) and Q=(X1,Y1,Z1) according to the following steps, with 
the calculations in each of the steps being effected modulo p: 

Replacing X0 with T2*X0, Y0 with T3*Y0 and Z0 with 1*Z0; 

Drawing at random an integer m such that 0 <m< p; 

Replacing XI with m^2*Xl, Yl with m^3*Yl and Zl with m*Zl; 

Calculate U0=X0*zr2; 

Calculate S0=Y0*Z1"3; 

Calculate U1=X1*Z(T2; 

Calculate SI =Y1*Z(T3; 

Calculate W=U0-U1; 

Calculate R=S0-S1; 

Calculate T=U0+U1; 

Calculate M = S0+S1; 

Calculate Z2=ZO*Zl*W; 

Calculate X2=R A 2-T*W A 2; 

Calculate V = T*W A 2-2*X2; and 
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Calculate 2*Y2=V*R-M*W"3. 



5. (Amended) A countermeasure method according to Claim 1, wherein the 
elliptical curve is defined on the finite field GF(2 A n), where n is a prime number, and the 
step of drawing a random integer comprises 

Drawing at random a non-zero element 1 of GF(2 A n). 

6. (Amended) A countermeasure method according to Claim 1,5, further 
including the following steps: 

Calculate Z2=X'1*Z'1 A 2; 
Calculate X2 = (X'l + c*Z' 1*2)^4; 
Calculate U=Z2+X'l A 2+Y'l*Z'l; and 
Calculate Y2=X'1"4*Z2+U*X2. 



7. (Amended) A countermeasure method according to Claim 5, further 
including the following steps, with the calculation in each of the steps being carried out 
modulo p: 

For an input point P = (X0, YO, ZO), replacing XO with T2*X0, YO with 
r3*Y0 and ZO with 1*Z0; 

3) Drawing at random a non-zero element m of GF(2 A n); 

4) For an input point Q = (XI, Yl, Zl), replacing XI with m A 2*Xl, Yl 
with m"3*Yl and Zl with m*Zl; and 



Application No. Unassigned 
Attorney's Docket No. 03232$- 169 
Page 6 



5) Calculating R=P+Q. 

8. (Amended) A countermeasure method according to Claim 5, further 
including the following steps: 

For an input point P = (X0, Y0, Z0), replacing X0 with T2*X0, YO with 
T3*Y0 and ZO with 1*Z0; 

Drawing at random a non-zero element m of GF(2 A n); 

For an input point Q = (XI, Yl, Zl) replacing XI with m"2*Xl, Yl with 
m"3*Yl and Zl with m*Zl; 

Calculate U0=X0*Z1"2; 

Calculate SO =Y0*Z1" 3; 

Calculate U1=X1*Z0"2; 

Calculate SI =Y1*Z0"3; 

Calculate W=U0+U1; 

Calculate R=S0 + SI; 

Calculate L=Z0*W; 

Calculate V = R*X1 + L*Y1 ; 

Calculate Z2=L*Z1; 

Calculate T=R+Z2; 

Calculate X2 = a*Z2"2+T*R+W"3; and 

Calculate Y2=T*X2+V*L"2. 
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9. (Amended) A countermeasure method according to Claim 1, further 
including the process of randomizing the representation of a point at the start of the 
calculation by the use of a "double and add" algorithm, taking as an input a point P and an 
integer d, the integer d being denoted d = (d(t),d(t-l),...,d(0)), where (d(t),d(t-l ),..., d(0)) is 
the binary representation of d, with d(t) the most significant bit and d(0) the least significant 
bit, the algorithm returning as an output the point Q=d.P, according to the following steps: 

1) Initialising the point Q with the value P; 

2) Replacing Q with 2.Q; 

3) If d(t-l) = 1 replacing Q with Q+P; 

4) For i ranging from t-2 to 0 executing the steps of: 

4a) Replacing Q with 2Q; 

4b) If d(i) = 1 , replacing Q with Q+P; and 

5) Returning Q. 

10. (Amended) A countermeasure method according to Claim 1, further 
including the process of randomizing the representation of a point at the start of the 
calculation method and at the end of the calculation method, using a "double and add" 
algorithm, taking as an input a point P and an integer d, the integer d being denoted 
d = (d(t),d(t-l),...,d(0)), where (d(t),d(t-l),...,d(0)) is the binary representation of d, with 
d(t) the most significant bit and d(0) the least significant bit, the algorithm returning as an 
output the point Q=d.P, according to the following steps: 
1) Initialising the point Q with the value P; 
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2) Replacing Q with 2. Q; 

3) If d(t-l) = 1 , replacing Q with Q+P; 

4) For i ranging from t-2 to 1 , executing the steps of: 

4a) Replacing Q with 2Q; 

4b) If d(i) = 1 , replacing Q with Q+P; 

5) Replacing Q with 2.Q; 

6) If d(0) = 1, replacing Q with Q+P and; 

7) Returning Q. 

11. (Amended) A countermeasure method according to Claim 1, further 
including the following steps: 

1) Initialising the point Q with the point P; 

2) For i ranging from t-2 to 0, executing the steps of: 

2a) Replacing Q with 2Q; 

2b) If d(i) = l, replacing Q with Q+P; and 

3) Returning Q. 

12. (Amended) A countermeasure method according to Claim 1, further 
including the following steps: 

1) Initialising the point Q with the point P. 

2) Initialising a counter co to the value T. 

3) For i ranging from t-1 to 0, executing the steps of: 
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3a) Replacing Q with 2Q using a first method if co is different from 



0, otherwise using method; 

3b) If d(i) = 1 , replacing Q with Q+P; 
3 c) If co=0 then reinitialising the counter co to the value T; 
3d) Decrementing the counter co; and 
4 Returning Q. 

13. (Amended) The method of claim 1, wherein said electronic component is a 



Entry of the foregoing amendment is respectfully requested. This amendment is 
intended to place the claims in a more conventional format and eliminate the multiple 
dependency of the claims. 



smart card. 



REMARKS 



Respectfully submitted, 



Burns, Doane, Swecker & Mathis, l.l.p. 



By: 



James A. LaBarre 
Registration No. 28,632 




P.O. Box 1404 

Alexandria, Virginia 22313-1404 
(703) 836-6620 



Date: September 26, 2001 
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Attachment to Preliminary Amendment dated September 26, 2001 
Marked-up Claims 1-13 

1 . (Amended) A countermeasure method in an electronic component 
implementing an elliptical curve type public key encryption algorithm [using the 
representation of the points of the said elliptical curve in projective coordinates, consisting 
of representing] , wherein a point P on the elliptical curve is represented by the projective 
coordinates (X, Y, Z) such that x=X/Z and y=Y/Z"3, x and y being the coordinates of the 
point on the elliptical curve in terms of affine coordinates, [the] said curve comprising n 
elements and being defined on a finite field GF(p), where p [being] is a prime number [, the 
said curve having] and the curve has the equation y^2=x^3 + a*x+b, or defined on a finite 
field GF(2^n), with the [said] curve having the equation y^2 + x*y = x^3+a*x^2+b, where 
a and b are integer parameters [fixed at the start], the [said] method comprising the steps 
Qfl 

[choosing a random integer representative from amongst n possible elements 
in terms of projective coordinates of the elliptical curve and consisting of a modification of 
the operations of addition of points, doubling of the said points and/or a modification of the 
scalar multiplication operation, characterised in that the countermeasure applies whatever 
the method or algorithm, hereinafter denoted A, used for performing the point doubling 
operation, the method A being replaced by the method A' in three steps, using an input 
defined by a point P = (X1,Y1,Z1) represented in terms of projective coordinates and an 
output defined by point Q = (X2,Y2,Z2) represented in terms of projective coordinates such 
that Q=2.P, of the elliptical curve, the said steps being:] 
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1) Drawing at random an integer 1 such that 0 < 1< p; 

2) For a point P represented hy projective coordinates (XI . Yl . ZD . 
calculating X'1 = 1 A 2*X1, Y'l=r3*Yl and Z'1 = 1*Z1, [X'l, Y'l and Z'l defining] 1q 
define the coordinates of the point P' = (X'l, Y'l, Z'l); and 

3) Calculating an output point Q=2*P' [by means of the algorithm A] that 
is represented by projective coordinates fX2. Y2. Z2) . 

2. (Amended) A countermeasure method according to Claim 1 , [characterised 
in that the point doubling algorithm, or operations of doubling points on an] wherein the 
elliptical curve is defined on the [said] finite field GF(p), [is effected in eight] and the step 
of calculati n g Q includes the following steps: 

[1) Drawing at random an integer 1 such that 0 < 1< p; 

2) Calculate X'l = r2*Xl, Y'l = r3*Yl and Z'1=1*Z1; 

3) ] Calculate M = 3*X'1^2+a*Z' 1^4; 

[4) ] Calculate Z2=2*Y'l*Z'l; 

[5) ] Calculate S=4*X'1*YT2; 

[6) ] Calculate X2=M"2-2*S; 

[7) ] Calculate T = 8*Y'1 A 4; and 

[8) ] Calculate Y2 = M*(S-X2)-T . 
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3 . (Amended) A countermeasure method according to Claim 1 , [characterised 
in that more generally the countermeasure method applies whatever the method denoted 
hereinafter A used for performing the points addition operation on an] wherein the elliptical 
curve is defined on the [said] finite field GF(p) + [is effected in five] and further including 
the following steps: 

[1) ] Drawing at random a non-zero integer 1 of GF(2^n); 

[2) ] Replacing X0 with T2*X0, Y0 with T3*Y0 and Z0 with 1*Z0; 

[3) ] Drawing at random a non-zero integer m of GF(2^n); 

[4) ] Replacing XI with m"2*Xl, Yl with m^3*Yl and Zl with m*Zl; and 

[5) ] Calculating R=P + Q [by means of algorithm A]. 

4. (Amended) A countermeasure method according to Claim 1, [characterised 
in that the modification of the point addition algorithm for an elliptical curve defined on the 
finite field GF(p), where p is a prime number, is as follows:] further including the 
calculation of the projective coordinates of the point R=(X2,Y2,Z2) such that R=P+Q 
with P = (X0,Y0,Z0) and Q = (X1,Y1,Z1) [are calculated by] according to the following 
[method in 16] steps, with the calculations in each of the steps [the calculations] being 
effected modulo p: 

[1) Drawing at random an integer 1 belonging to the finite field GF(p) such 

that 0<l<p; 
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2)] Replacing X0 with T2*X0, Y0 with T3*Y0 and Z0 with 1*Z0; 

[3) ] Drawing at random an integer m [belonging] such that 0 < m< p; 

[4) ] Replacing XI with m A 2*Xl, Yl with m A 3*Yl and Zl with m*Zl; 

[5) ] Calculate U0=X0*Z1 A 2; 

[6) ] Calculate S0=Y0*Z1 A 3; 

[7) ] Calculate U1=X1*Z0 A 2; 

[8) ] Calculate SI =Y1*Z0 A 3; 

[9) ] Calculate W=U0-U1; 

[10) ] Calculate R=S0-S1; 

[1 1) ] Calculate T = U0 + Ul ; 

[12) ] Calculate M = SO + S 1 ; 

[13) ] Calculate Z2=ZO*Zl*W; 

[14) ] Calculate X2=R A 2-T*W A 2; 

[15) ] Calculate V=T*W A 2-2*X2; aM 

[16) ] Calculate 2* Y2=V*R-M*W A 3. 



5. (Amended) A countermeasure method according to Claim 1, [characterised 
in that, more generally, the modification of the point addition algorithm for an] wherein the 
elliptical curve is defined on the finite field GF(2 A n), where n is a prime number, and the 
step of drawing a random integer comprises [is as follows: the projective coordinates of the 
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Marked-up Claims 1-13 

point P = (X1,Y1,Z1) such that R=P + Q and Q = (X2,Y2,Z2) are calculated by the 
following method in 3 steps, in each of the steps the calculations being carried out modulo 
p: 

1) ] Drawing at random a non-zero element 1 of GF(2 A n)[; 

2) Calculating X'l = r2*Xl, Y'l=r3*Yl and Z'1=1*Z1, X'l, Y'l and 
Z'l defining the coordinates of the point P' = (X'l,Y'l,Z'l); 

3) Calculating Q=2.P' by means of the algorithm A]. 

6. (Amended) A countermeasure method according to Claim 1, [characterised 
in that the countermeasure method consists of a modification of the previous method, the 
new point doubling method for an elliptical curve being defined on the finite field GF(2^n), 
and consists of the following 6] 5, further including the following steps: 
[1) Drawing at random a non-zero element 1 of GF(2^n); 

2) Calculate X'l =1 A 2*X1, Y'l=r3*Yl, Z'1=1*Z1; 

3) ] Calculate Z2=X'1*Z'1"2; 

[4) ] Calculate X2 = (X'l +c*Z'l A 2) A 4; 

[5) ] Calculate U=Z2+X'l"2+Y'l*Z'l; and 

[6) ] Calculate Y2 =X' 1"4*Z2 + U*X2. 
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7. (Amended) A countermeasure method according to Claim [1, characterised 
in that, more generally, the modification of the point addition algorithm for an elliptical 
curve defined on the finite field GF(2^n), where n is a prime number, is as follows: the 
projective coordinates of the point P = (X0,Y0,Z0) and Q = (X1,Y1,Z2) at the input and 
R=(X2,Y2,Z2) are calculated by the following method in 5 steps,] 5, further including the 
following steps, with the calculation in each of the steps [the calculations] being carried out 
modulo p: 

[1) Drawing at random a non-zero element 1 of GF(2^n); 

2) ] For an input point P = (X0. Y0. Z0). replacing X0 with T2*X0, Y0 with 
T3*Y0 and Z0 with 1*Z0; 

3) Drawing at random a non-zero element m of GF(2^n); 

4) For an input point O = OC1 . Yl . Z1V replacing XI with m"2*Xl, Yl 
with m"3*Yl and Zl with m*Zl; and 

5) Calculating R=P+Q [using the algorithm A]. 

8. (Amended) A countermeasure method according to Claim [1, characterised 
in that the countermeasure method consists of a modification of the point addition method 
for an elliptical curve defined on the finite field GF(2^n) and consists of] 5, further 
including the following [16] steps: 

[1) Drawing at random a non-zero element 1 of GF(2 A n); 
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2)] For an input point P = (X0, Y0, Z0) , replacing X0 with T2*X0, Y0 with 
T3*Y0 and Z0 with 1*Z0; 

[3) ] Drawing at random a non-zero element m of GF(2 A n); 

[4) ] For an input point Q = OCT , Y1 . 71) replacing XI with m A 2*Xl, Yl 
with m A 3*Yl and Zl with m*Zl; 

[5) ] Calculate U0=X0*Z1 A 2; 

[6) ] Calculate SO = Y0*Z 1*3 ; 

[7) ] Calculate U1=X1*Z0"2; 

[8) ] Calculate S 1 = Y 1 *Z0*3 ; 

[9) ] Calculate W=U0+U1; 

[10) ] Calculate R=S0 + S1; 

[11) ] Calculate L=Z0*W; 

[12) ] Calculate V=R*X1+L*Y1; 

[13) ] Calculate Z2 = L*Z1; 

[14) ] Calculate T=R+Z2; 

[15) ] Calculate X2=a*Z2*2+T*R+W*3; and 

[16) ] Calculate Y2=T*X2+V*L*2. 



9. (Amended) A countermeasure method according to Claim 1, [characterised 
in that the first variant of a modification of the scalar multiplication operation consists of 



Application No. Unassigned 
Attorney's Docket No. 032326-169 
Page 8 

Attachment to Preliminary Amendment dated September 26, 2001 
Marked-up Claims 1-13 

making random] further in cluding the process of randomizing the representation of a point 
at the start of the calculation [method] by the use of [the] a "double and add" algorithm, 
[the modified method of scalar multiplication is as follows in 5 steps,] taking as an input a 
point P and an integer d, the integer d being denoted d=(d(t),d(t-l),...,d(0)), where 
(d(t),d(t-l),...,d(0)) is the binary representation of d, with d(t) the most significant bit and 
d(0) the least significant bit, the algorithm returning as an output the point Q=d.P, [the 
method Do being the points doubling method, the method Do' being the modified points 
doubling method according to any one of the preceding claims, this first variant being 
executed in five] according to the following steps: 

1) Initialising the point Q with the value P; 

2) Replacing Q with 2.Q [using the method Do']; 

3) If d(t-l)= 1 replacing Q with Q+P [using the method Ad]; 

4) For i ranging from t-2 to 0 executing the steps of : 

4a) Replacing Q with 2Q; 

4b) If d(i) = 1, replacing Q with Q + P; and 

5) Returning Q. 

10. (Amended) A countermeasure method according to Claim 1, [characterised 
in that the second variant of the scalar multiplication operation consists in making random] 
further including the process of randomizing the representation of a point at the start of the 
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calculation method and at the end of the calculation method, [this in the case of the use of 
the] using a "double and add" algorithm, [the modified scalar multiplication method being 
the following one in 7 steps,] taking as an input a point P and an integer d, the integer d 
being denoted d=(d(t),d(t-l),...,d(0)), where (d(t),d(t-l),...,d(0)) is the binary 
representation of d, with d(t) the most significant bit and d(0) the least significant bit, the 
algorithm returning as an output the point Q = d.P, [the said second variant being executed 
in seven] according to the following steps: 

1) Initialising the point Q with the value P; 

2) Replacing Q with 2.Q [using the method Do']; 

3) If d(t-l) = 1, replacing Q with Q + P [using the method Ad]; 

4) For i ranging from t-2 to 1, executing the steps of : 

4a) Replacing Q with 2Q; 

4b) If d(i) = 1, replacing Q with Q+P; 

5) Replacing Q with 2.Q [using the method Do']; 

6) If d(0) = 1, replacing Q with Q+P [using the method Ad] and ; 

7) Returning Q. 



11. (Amended) A countermeasure method according to Claim 1, [characterised 
in that the third variant of the scalar multiplication operation is executed in three] further 
including t he following steps: 
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1) Initialising the point Q with the point P; 

2) For i ranging from t-2 to 0, executing the steps of : 

2a) Replacing Q with 2Q [using the method Do']; 
2b) If d(i) = 1, replacing Q with Q + P [using the method Ad', Ad' 
being the method of addition of the modified points according to the preceding claims]; and 

3) Returning Q. 



12. (Amended) A countermeasure method according to Claim 1, [characterised 
in that the fourth variant of the scalar multiplication operation is executed in three] further 
including the following steps: 

1) Initialising the point Q with the point P. 

2) Initialising [the] a counter co to the value T. 

3) For i ranging from t-1 to 0, executing the step s of- 

3a) Replacing Q with 2Q using [the] a first method [Do] if co is 
different from 0, otherwise using [the] method [Do'.]; 

3b) If d(i) = 1, replacing Q with Q+P [using the method Ad.]; 
3c) If co=0 then reinitialising the counter co to the value T[.]; 
3d) Decrementing the counter co[.] : and 
[3)] 4 Returning Q. 
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13. (Amended) [An] The method of claim 1 , wherein said electronic component 
[using the method according to any one of the preceding claims, characterised in that it can 
be] is a smart card. 
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COUNTERMEASURE METHODS IN AN ELECTRONIC COMPONENT 
IMPLEMENTING AN ELLIPTICAL CURVE TYPE PUBLIC KEY 
ENCRYPTION ALGORITHM 

5 The present invention relates to a countermeasure 

method in an electronic component using an elliptical 
curve type public key enciphering algorithm. 

In the conventional model of secret key 
encryption, two persons wishing to communicate by means 

10 of a non-secure channel must first agree on a secret 
enciphering key K. The enciphering function and the 
deciphering function use the same key K. The drawback 
of the secret key enciphering system is that the said 
system requires the prior communication of the key K 

15 between the two persons by means of a secure channel, 
before any enciphered message is sent over the non- 
secure channel. In practice, it is generally difficult 
to find a perfectly secure communication channel, 
particularly if the distance separating the two persons 

20 is great. Secure channel means a channel for which it 
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is impossible to know or modify the information passing 
over the said channel. Such a secure channel can be 
implemented by means of a cable connecting two 
terminals, possessed by the said two persons. 
5 The concept of public key encryption was invented 

by Whitfield Diffie and Martin Hellman in 197 6. Public 
key encryption makes it possible to resolve the problem 
of the distribution of the keys over a non-secure 
channel. The principle of public key encryption 

10 consists in using a pair of keys, a public enciphering 
key and a private deciphering key. It must be 
unfeasible from the calculation point of view to find 
the private deciphering key from the public enciphering 
key. A person A wishing to communicate information to 

15 a person B uses the public enciphering key of the 
person B. Only the person B possesses the private key 
associated with his public key. Only the person B is 
therefore capable of deciphering the message sent to 
him. 

20 Another advantage of public key encryption over 

secret key encryption is that public key encryption 
allows authentication by the use of an electronic 
signature . 

The first implementation of the public key 
25 enciphering scheme was developed in 1977 by Rivest, 
Shamir and Adleman, who invented the RSA enciphering 
system. RSA security is based on the difficulty of 
factorising a large number which is the product of two 
prime numbers . 
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Since then, many public key enciphering systems 
have been proposed, the security of which is based on 
different calculatory problems (this list is not 
exhaustive) : 
5 - Merckle-Hellman backpack: 

This enciphering system is based on the 
difficulty of the problem of the sum of subsets. 

- McEliece: 

This enciphering system is based on the theory of 
10 algebraic codes. It is based on the problem of the 
decoding of linear codes. 

- El Gamal: 

This enciphering system is based on the 
difficulty of the discrete logarithm in a finite field. 

15 - Elliptical curves: 

The elliptical curve enciphering system 
constitutes a modification to existing cryptographic 
systems in order to apply them to the field of 
elliptical curves. 

20 The use of elliptical curves in cryptographic 

systems was proposed independently by Victor Miller and 
Neal Koblitz in 1985. Actual applications of 

elliptical curves were envisaged early in the 1990s. 

The advantage of cryptosys terns based on 

25 elliptical curves is that they provide security 
equivalent to other cryptosystems but with smaller key 
sizes. This saving in key size entails a decrease in 
memory requirements and a reduction in calculation 
times, which makes the use of elliptical curves 
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particularly suitable for applications of the smart 
card type . 

An elliptical curve on a finite field GF(q A n) (q 
being a prime number and n an integer) is the set of 
5 points (x,y) with x the X-axis and y the Y-axis 
belonging to GF(q A n) the solution to the equation: 
y A 2=x A 3+a*x+b 

if q is greater than or equal to 3 and 
y A 2+x*y=x A 3+a*x A 2+b 
10 if q=2. 

There are 2 methods for representing a point on 
an elliptical curve: 

Firstly, affine coordinates representation; in 
this method, a point P on the elliptical curve is 
15 represented by its coordinates (x,y). 

Secondly, projective coordinates representation. 
The advantage of projective coordinates 
representation is that it makes it possible to avoid 
divisions in the finite field, the said divisions being 
20 the most expensive operations in terms of calculation 
time . 

The most frequently used projective coordinates 
representation is that consisting of representing a 
point P on the elliptical curve by the coordinates 
25 (X,Y,Z), such that x=X/Z and y=Y/Z A 3. 

The projective coordinates of a point are not 
unique since the triplet (X,Y, Z) and the triplet 
<A. A 2*X, A, A 3*Y, A.*Z) represent the same point whatever 
the element X belonging to the finite field on which 
30 the elliptical curve is defined. 
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The two classes of curves which are most used in 
encryption are the following: 

1) Curves defined on the finite field GF(p) (the 
set of integers modulo p, p being a prime number) 

5 having the equation: 
y A 2=x A 3+a*x+b 

2) Curves defined on the finite field GF(2 A n) 
having the equation 

y A 2+x*y=x A 3+a*x A 2+b 

10 For each of these two classes of curve, the point 

addition and point doubling operations are defined. 

Point addition is the operation which, given two 
points P and Q, calculates the sum R=P+Q, R being a 
point on the curve whose coordinates are expressed by 

15 means of the coordinates of the points P and Q in 
accordance with formulae whose expression is given in 
the work "Elliptical curve public key cryptosystem" by 
Alfred J. Menezes. 

Point doubling is the operation which, given a 

20 point P, calculates the point R=2*P, R being a point on 
the curve whose coordinates are expressed by means of 
the coordinates of the point P in accordance with the 
formulae whose expression is given in the work 
"Elliptical curve public key cryptosystem" by Alfred J. 

25 Menezes. 

The point addition and point doubling operations 
make it possible to define a scalar multiplication 
operation: given a point P belonging to an elliptical 
curve and an integer d, the result of the scalar 
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multiplication of P by d is the point Q such that 
Q=d*P=P+P+...+ P d times. 

The security of encryption algorithms on 
elliptical curves is based on the difficulty of the 
5 problem of the discrete logarithm on elliptical curves, 
the said problem consisting, using two points Q and P 
belonging to an elliptical curve E, in finding, if such 
exists, an integer x such that Q=x*P. 

There are many cryptographic algorithms based on 
10 the problem of the discrete logarithm. These 
algorithms are easily transposable to elliptical 
curves . 

Thus it is possible to use algorithms providing 
authentication, confidentiality, integrity check and 

15 key exchange. 

A point common to the majority of cryptographic 
algorithms based on elliptical curves is that they 
comprise as a parameter an elliptical curve defined on 
a finite field and a point P belonging to this 

20 elliptical curve. The private key is an integer d 
chosen randomly. The public key is a point on the 
curve Q such that Q=d*P. These cryptographic 

algorithms generally involve a scalar multiplication in 
the calculation of a point R=d*T, where d is the secret 

25 key. 

In the above section, an enciphering algorithm 
based on an elliptical curve is described. This scheme 
is similar to the El Gamal enciphering scheme. A 
message m is enciphered as follows: 
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The cipher clerk chooses an integer k randomly 
and calculates the points k*P=(xl,yl) and k*Q=(x2,y2) 
on the curve, and the integer c= x2 + m. The cipher of 
m is the triplet (xl,yl,c). 
5 The deciphering clerk, who possesses d, deciphers 

m by calculating: 

(x'2,y'2)=d(xl,yl) and m=c-x'2 

In order to effect the scalar multiplications 
necessary in the calculation methods described 
10 previously, several algorithms exist: 
"Double and add" algorithm; 
"Addition- subtract ion" algorithm; 
Algorithm with addition chains; 
Algorithm with window; 
15 Algorithm with signed representation. 

This list is not exhaustive. The simplest 

algorithm and the one which is most used is the "double 
and add" algorithm. The "double and add" algorithm 
takes as its input a point P belonging to a given 
20 elliptical curve and an integer d. The integer d is 
denoted d= (d (t) , d (t-1 ),..., d ( 0 )) , where (d(t),d(t- 
l),...,d(0)) is the binary representation of d, with d(t) 
the most significant bit and d(0) the least significant 
bit. The algorithm returns as an output the point 
25 Q=d.P. 

The "double and add" algorithm includes the 
following three steps: 

1) Initialising the point Q with the value P 

2) For i ranging from t-1 to 0, executing: 
30 2a) Replacing Q with 2Q 



2b) If d(i)=l replacing Q with Q+P 
3) Returning Q. 

It became clear that the implementation of a 
public key enciphering algorithm of the elliptical 
5 curve type on a smart card was vulnerable to attacks 
consisting of a differential analysis of current 
consumption making it possible to find the private 
deciphering key. These attacks are known as DPA 
attacks, the acronym for Differential Power Analysis. 

10 The principle of these DPA attacks is based on the fact 
that the current consumption of the microprocessor 
executing the instructions varies according to the data 
item being manipulated. 

In particular, when an instruction is 

15 manipulating a data item in which a particular bit is 
constant, where the value of the other bits may vary, 
analysis of the current consumption related to the 
instruction shows that the mean consumption of the 
instruction is not the same according to whether the 

20 particular bit takes the value 0 or 1 . The attack of 
the DPA type therefore makes it possible to obtain 
additional information on the intermediate data 
manipulated by the microprocessor of the card when a 
cryptographic algorithm is being executed. This 

25 additional information can in some cases reveal the 
private parameters of the deciphering algorithm, making 
the cryptographic system insecure. 

In the remainder of this document a description 
is given of a method of DPA attack on an algorithm of 

30 the elliptical curve type performing an operation of 
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the type consisting of the scalar multiplication of a 
point P by an integer d, the integer d being the secret 
key. This attack directly reveals the secret key d. 
It therefore seriously compromises the security of the 
5 implementation of elliptical curves on a smart card. 

The first step of the attack is the recording of 
the current consumption corresponding to the execution 
of the "double and add" algorithm described previously 
for N distinct points P<1),.„, P (N) . In an algorithm 

10 based on elliptical curves, the microprocessor of the 
smart card will perform N scalar multiplications 
d.P(l) ,...,d.P(N) . 

For clarity of the description of the attack, the 
first step is to describe a method for obtaining the 

15 value of the bit d(t-l) of the secret key d, where 
(d(t) ,d{t-l) ,...,d(0) ) is the binary representation of d, 
with d(t) the most significant bit and d(0) the least 
significant bit. Next the description of an algorithm 
which makes it possible to find the value of d is 

2 0 given. 

The points P(l) to P (N) are grouped together 
according to the value of the last bit of the abscissa 
of 4.P, where P designates one of the points P(l) to 
P(N) . The first group consists of the points P such 

25 that the last bit of the abscissa of 4.P is equal to 1. 

The second group consists of the points P such 
that the last bit of the abscissa of 4.P is equal to 0. 
The mean of the current consumptions corresponding to 
each of the two groups is calculated, and the 

30 difference curve between these two means is calculated. 
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If the bit d(t-l) of d is equal to 0, then the 
scalar multiplication algorithm previously described 
calculates and stores in memory the value of 4. P. This 
means that, when the algorithm is executed in a smart 
5 card, the microprocessor of the card will actually 
calculate 4. P. In this case, in the first message 
group, the last bit of the data item manipulated by the 
microprocessor is always at 1, and in the second 
message group the last bit of the data item manipulated 

10 is always at 0. The mean of the current consumptions 
corresponding to each group is therefore different. 
There therefore appears, in the difference curve 
between the two means, a differential current 
consumption peak. 

15 If on the other hand the bit d(t-l) of d is equal 

to 1, the exponentiation algorithm described previously 
does not calculate the point 4. P. When the algorithm 
is executed by the smart card, the microprocessor 
therefore never manipulates the data item 4. P. 

20 Therefore no differential consumption peak appears. 

This method therefore makes it possible to 
determine the value of the bit d(t-l) of d. 

The algorithm described in the following section 
is a generalisation of the previous algorithm. It 

25 makes it possible to determine the value of the secret 
key d. 

The input is defined by N points denoted P{1) to 
P(N) corresponding to N calculations performed by the 
smart card, and the output by an integer h. 
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The said algorithm is implemented as follows in 
three steps. 

1) Executing h=l; 

2) For i ranging from t-1 to 1, executing: 

5 2)1) Classifying the points P(l) to P (N) 

according to the value of the last bit of the 
abscissa of (4*h) . P; 

2)2) Calculating the current consumption 
mean for each of the two groups; 
10 2)3) Calculating the difference between the 

two means; 

2)4) If the difference shows a differential 
consumption peak, doing h=h*2; otherwise doing 
h=h*2+l; 
15 3) Returning h. 

The above algorithm supplies an integer h such 
that d=2*h or d=2*h+l. In order to obtain the value of 
d, it then suffices to test the two possible 
hypotheses . 

20 The attack of the DPA type described therefore 

makes it possible to find the private key d. 

The method of the invention consists in devising 
of a countermeasure for guarding against the DPA attack 
described above. This countermeasure uses the 

25 representation of the points on the elliptical curve in 
projective coordinates. 

As explained above, the representative of a point 
in projective coordinates is not unique. If the finite 
field on which the elliptical curve is defined 
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comprises n elements, it is possible to choose one 
representative amongst n-1 possible ones. 

By choosing a random representative of a point on 
which the calculation is carried out, the intermediate 
5 values of the calculation themselves become random and 
therefore unpredictable from outside, which makes the 
DPA attack described above impossible. 

The countermeasure method consists of a 
modification of the elliptical curve point doubling and 
10 point addition operations defined on the finite fields 
GF(p) for p prime and GF(2 /% n). The modification of the 
point addition and point doubling operations on 
elliptical curves defined on the finite fields GF(p) 
for p prime and GF(2 A n) apply whatever the algorithm 
15 used for performing these operations. 

The countermeasure method also consists of the 
definition of four variants in the scalar 
multiplication operation. These four variants apply 
whatever the algorithm used for performing the scalar 
20 multiplication operation. 

In this section, a description is given of the 
modification of the point doubling algorithm for an 
elliptical curve defined on the finite field GF(p), 
where p is a prime number. The elliptical curve is 
25 therefore defined by the following equation: 
y^2=x^3+a*x+b 

where a and b are integer parameters fixed at the 

start . 

The projective coordinates of the point 
30 Q=(X2,Y2,Z2) such that Q=2 . P with P=(X1,Y1,Z1) are 
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calculated by the following method in 6 steps. In each 
of the steps, the calculations are effected modulo p. 

1) Calculate M=3*Xl A 2+a*Zl A 4 ; 

2) Calculate Z2=2*Y1*Z1; 

3) Calculate S=4*X1*Y1 A 2; 

4) Calculate X2=M A 2=2*S; 

5) Calculate T=8*Y1 A 4; 

6) Calculate Y2=M* (S-X2 ) -T . 

The countermeasure method consists of a 
modification of the above method. 

The new method of point doubling for an 
elliptical curve defined on the finite field GF(p) 
consists of the following 8 steps: 



0<A,<p; 



1) 


Drawing 


at random an integer 


X such that 


2) 


Calculate 


X' 1=A. A 2*X1, Y'1=A, A 3*Y1 


and Z'1=A,*Z1; 


3) 


Calculate 


M=3*X' l A 2+a*Z' 1 A 4; 




4) 


Calculate 


Z2=2*Y' 1*Z' 1; 




5) 


Calculate 


S=4*X' 1*Y' 1 A 2; 




6) 


Calculate 


X2=M A 2-2*S; 




7) 


Calculate 


T=8*Y' 1 A 4; 




8) 


Calculate 


Y2=M* (S-X2) -T. 





More generally, the countermeasure method applies 
whatever the method (hereinafter denoted A) used for 
performing the point doubling operation. The method A 
is replaced by the method A' in 3 steps: 

Input: a point P=(X1,Y1,Z1) represented in 
projective coordinates. 

Output: a point Q=(X2,Y2,Z2) represented in 
projective coordinates such that Q=2.P. 
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1) Drawing at random an integer A, such that 

0<X<p; 

2) Calculating X'l=A, A 2*Xl, Y' 1=A. A 3*Y1 and 
Z' 1=X*Z1, X'l, Y'l and Z'l defining the coordinates of 
the point P' = (X' 1, Y' 1, Z' 1) ; 

3) Calculating Q=2* 



by means of the algorithm 



The variables manipulated during the execution of 
the method A' being random, the previously described 
DPA attack no longer applies. 

In this paragraph, a description is given of the 
modification to the point addition algorithm for an 
elliptical curve defined on the finite field GF(p), 
where p is a prime number. 

The projective coordinates of the point 
R=(X2,Y2,Z2) such that R=P+Q with P=(X0,Y0,Z0) and 
Q=(X1,Y1,Z1) are calculated by the following method in 
12 steps. In each of the steps, the calculations are 
carried out modulo p. 

1) Calculate U0=X0*Z1^2; 

2) Calculate S0=Y0*Z1 A 3; 

3) Calculate U1=X1*Z0 A 2; 

4) Calculate S1=Y1*Z0 A 3 ; 

5) Calculate W=U0-U1; 

6) Calculate R=S0-S1; 

7) Calculate T=U0+U1; 

8) Calculate M=S0+S1; 

9) Calculate Z2=Z0*Z1*W; 

10) Calculate X2=R A 2-T*W A 2 ; 



15 



11) Calculate V=T*WT2-2*X2 ; 

12) Calculate 2* Y2=V*R-M*W A 3 . 

The count ermea sure method consists of a 
modification of the previous method. The new method of 
5 point addition for an elliptical curve defined on the 
finite field GF(p) consists of the following 16 steps: 

1) Drawing at random an integer X such that 

0<A,<p; 

2) Replacing XO with X^2*X0, YO with A, A 3*Y0 and 
10 Z0 with A*Z0; 

3) Drawing at random an integer |Li such that 

0<|Lt<p; 

4) Replacing XI with u A 2*Xl, Yl with |u A 3*Yl and 



Zl with u*Zl; 



15 


5) 


Calculate 


U0=X0*Z1 A 2; 




6) 


Calculate 


S0=Y0*Z1 A 3; 




7) 


Calculate 


U1=X1*Z0 A 2; 




8) 


Calculate 


S1=Y1*Z0 A 3; 




9) 


Calculate 


W=U0-U1; 


20 


10) 


Calculate 


R=S0-S1; 




11) 


Calculate 


T=U0+U1; 




12) 


Calculate 


M=S0+S1; 




13) 


Calculate 


Z2=Z0*Z1*W; 




14) 


Calculate 


X2=R A 2-T*W A 2; 


25 


15) 


Calculate 


V=T*W*2-2*X2; 




16) 


Calculate 


2*Y2=V*R-M*W A 3 



More generally, the countermeasure method applies 
whatever the method (hereinafter denoted A) used for 
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performing the point addition operation. The method A 
is replaced by the method A' in 5 steps: 

Input: two points P=(X0,Y0,Z0) and Q=(X1,Y1,Z1) 
represented in projective coordinates. 
5 Output: the point R=(X2,Y2,Z2) represented in 

projective coordinates such that R=P+Q. 

1) Drawing at random an integer X such that 

0<A.<p; 

2) Replacing XO with A, A 2*X0, YO with A, A 3*Y0 and 
10 Z0 with A*Z0; 

3) Drawing at random an integer \x such that 

0<|J,<p; 

4) Replacing XI with |li a 2*X1, Yl with jj, a 3*Y1 and 
Zl with n*Zl; 

15 5) Calculating R=P+Q by means of algorithm A. 

The variables manipulated during the execution of 
the method A' being random, the previously described 
DPA attack no longer applies. 

In this section, a description is given of the 
20 modification of the point doubling algorithm for an 
elliptical curve defined on the finite field GF(2 A n). 
The elliptical curve is therefore defined by the 
following equation: 

y A 2+x*y=x A 3+a*x A 2+b 
25 where a and b are parameters belonging to the 

finite field GF(2 A n) fixed at the start. c is defined 
by the equation: 

c=b A (2 A (n-2) ) . 
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The projective coordinates of the point 
Q=(X2,Y2,Z2) such that Q=2 . P with P=(X1,Y1,Z1) are 
calculated by the following method in 4 steps. In each 
of the steps, the calculations are carried out in the 
5 finite field GF(2 A n). 

1) Calculate Z2=X1*Z1 A 2; 

2) Calculate X2= (Xl+c*Zl A 2 ) A 4 ; 

3) Calculate U=Z2+Xl A 2+Yl*Zl ; 

4) Calculate Y2=Xl A 4*Z2+U*X2 . 

10 The countermeasure method consists of a 

modification of the previous method. The new point 
doubling method for an elliptical curve defined on the 
finite field GF(2 A n) consists of the following 6 steps: 

1) Drawing at random a non-zero element X of 
15 GF(2 A n); 

2) Calculate X'1=X A 2*X1, Y'1=X A 3*Y1, Z'1=A*Z1; 

3) Calculate Z2=X' 1*Z ' 1 A 2 ; 

4) Calculate X2= (X' l+c*Z' 1 A 2) A 4; 

5) Calculate U=Z2+X' 1 A 2+Y' l*z' 1 ; 
20 6) Calculate Y2=X' 1 A 4*Z2+U*X2 . 

More generally, the countermeasure method applies 
whatever the method (hereinafter denoted A) used for 
performing the point doubling operation. The method A 
is replaced by the method A r in 3 steps: 
25 Input: a point P=(X1,Y1,Z1) represented in 

projective coordinates. 

Output: a point Q=(X2,Y2,Z2) represented in 
projective coordinates such that Q=2.P. 

1) Drawing at random a non-zero element A. of 
30 GF (2 A n) ; 
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2) Calculating X' 1=A, A 2*X1, Y'l=X A 3*Yl, Z'1=A*Z1, 
X'l, Y' 1 and Z' 1 defining the coordinates of the point 
P' = (X' 1, Y' 1, Z' 1) ; 

3) Calculation of Q=2 . P' using the algorithm A. 
5 The variables manipulated during the execution of the 

method A r being random, the previously described DPA 
attack no longer applies. 

In this section, a description is given of the 
modification of the point addition algorithm for an 

10 elliptical curve defined on the finite field GF(2 A n) . 

The projective coordinates of the point 
R=(X2,Y2,Z2) such that R=P+Q with P=(X0,YO,ZO) and 
Q=(X1,Y1,Z1) are calculated by the following method in 
12 steps. In each of the steps, the calculations are 

15 carried out in the finite field GF(2 A n). 





1) 


Calculate 


U0=X0*Z1 A 2; 




2) 


Calculate 


S0=Y0*Z1 A 3; 




3) 


Calculate 


Ul=Xl*Z0 A 2; 




4) 


Calculate 


S1=Y1*Z0 A 3; 


20 


5) 


Calculate 


W=U0+U1; 




6) 


Calculate 


R=S0+S1; 




7) 


Calculate 


L=Z0*W; 




8) 


Calculate 


V=R*X1+L*Y1 




9) 


Calculate 


Z2=L*Z1; 


25 


10) 


Calculate T=R+Z2; 



11) Calculate X2=a*Z2 A 2+T*R+W A 3 ; 

12) Calculate Y2=T*X2+V*L A 2 . 

The countermeasure method consists of a 
modification to the previous method. The new point 
30 addition method for an elliptical curve defined on the 
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finite field GF(2 A n) consists of the following 14 
steps : 

1) Drawing at random a non-zero element X of 
GF (2 A n) ; 

2) Replacing XO with X A 2*X0, YO with X A 3*Y0 and 
ZO with A*Z0; 

3) Drawing at random a non-zero element |a of 
GF (2 A n) ; 

4) Replacing XI with p A 2*Xl, Yl with |li a 3*Y1 and 
Zl with |U*Z1; 

5) Calculate U0=X0*Z1 A 2; 

6) Calculate S0=Y0*Z1 A 3; 

7) Calculate U1=X1*ZCT2; 

8) Calculate S1=Y1*Z0 A 3; 

9) Calculate W=U0+U1; 

10) Calculate R=S0+S1; 

11) Calculate L=Z0*W; 

12) Calculate V=R*X1+L* Yl ; 

13) Calculate Z2=L*Z1; 

14) Calculate T=R+Z2; 

15) Calculate X2=a*Z2 A 2+T*R+W A 3 ; 

16) Calculate Y2=T*X2+V*L A 2 . 

More generally, the countermeasure method applies 
whatever the method (hereinafter denoted A) used for 
performing the point addition operation. The method A 
is replaced by the method A' in 5 steps: 

Input: two points P=(X0,Y0,Z0) and Q=(X1,Y1,Z1) 
represented as projective coordinates. 
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Output: the point R=(X2,Y2,Z2) represented as 
projective coordinates such that R=P+Q. 

1) Drawing at random a non-zero element A, of 
GF (2^n) ; 

5 2) Replacing X0 with A,^2*X0, Y0 with X^3*Y0 and 

ZO with X*Z0; 

3) Drawing at random a non-zero element (J, of 
GF(2^n) ; 

4) Replacing XI with ^ A 2*X1, Yl with ju A 3*Yl and 
10 Zl with u*Zl; 

5) Calculating R=P+Q by means of the algorithm 

A. 

The variables manipulated during the execution of 
the method A' being random, the previously described 

15 DPA attack no longer applies. 

The countermeasure method also consists in 
defining four variants in the scalar multiplication 
operation. The scalar multiplication operation uses 
the point doubling operation denoted Do and the point 

20 addition operation denoted Ad. The modified point 
doubling operation described above is denoted Do' and 
the modified point addition operation described above 
is denoted Ad' . 

In this section a description is given of the 

25 first variation of the modification to the scalar 
multiplication operation. The first variant consists 
of making random the representation of a point at the 
start of the calculation method. In the case of the 
use of the "double and add" algorithm, the modified 
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scalar multiplication method is the following one in 5 
steps. The method takes as an input a point P and an 
integer d. The integer d is denoted d=(d(t),d(t- 
1) ,...,d(0) ) , where (d ( t ), d (t-1 ),..., d ( 0 ) ) is the binary 
5 representation of d, with d(t) the most significant bit 
and d(0) the least significant bit. The algorithm 
returns the point Q=d.P as an output. 

This first variant is executed in five steps. 

1) Initialising the point Q with the value P; 
10 2) Replacing Q with 2.Q using the method Do'; 

3) If d(t-l}=l replacing Q with Q+P using the 
method Ad; 

4) For i ranging from t-2 to 0 executing: 
4a) Replacing Q with 2Q; 

15 4b) If d(i)=l, replacing Q with Q+P; 

5) Returning Q. 

More generally, the method of the first variant 
described previously applies to the scalar 
multiplication operation whatever the method 
20 (hereinafter denoted A) used for effecting the 
calculation of the scalar multiplication. The method A 
uses the previously defined operations Do and Ad. 

The first variant of the countermeasure consists 
in replacing the first operation Do with Do' defined 
25 previously. 

The first variant therefore ensures that the 
intermediate variables manipulated during the scalar 
multiplication operation are random. This makes the 
previously described DPA attack inapplicable. 
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In this paragraph the second variant of 
modification of the scalar multiplication operation is 
described. 

The second variant consists in making random the 
5 representation of a point at the start of the 
calculation method and at the end of the calculation 
method. In the case of the use of the "double and add" 
algorithm, the modified scalar multiplication method is 
the following one in 7 steps. The method takes as an 
10 input a point P and an integer d. The integer d is 
denoted d= (d (t) , d (t-1 ),..., d ( 0 )) , where (d(t),d(t- 
l),...,d(0)) is the binary representation of d, with d(t) 
the most significant bit and d(0) the least significant 
bit. The algorithm returns the point Q=d.P as an 
15 output. 

This second variant is executed in seven steps: 

1) Initialising the point Q with the value P; 

2) Replacing Q with 2.Q using the method Do'; 

3) If d(t-l)=l, replacing Q with Q+P using the 
20 method Ad; 

4) For i ranging from t-2 to 1, executing: 
4a) Replacing Q with 2Q; 

4b) If d(i)=l, replacing Q with Q+P; 

5) Replacing Q with 2.Q using the method Do' ; 

25 6) If d(0)=l, replacing Q with Q+P using the 

method Ad; 

7) Returning Q. 

More generally, the method of the second variant 
described previously applies to the scalar 
30 multiplication operation whatever the method 



23 



(hereinafter denoted A) used for effecting the 
calculation of this scalar multiplication. The method 
A uses the operations Do and Ad defined previously. 
The second variant of the countermeasure consists of 
5 replacing the first operation Do with Do' defined 
previously and the last operation Do with Do' . 

The second variant therefore ensures that the 
intermediate variables manipulated during the scalar 
multiplication operation are random. The advantage of 
10 the second variant is increased security against DPA 
attacks at the end of the scalar multiplication 
algorithm. In particular, the second variant makes the 
previously described DPA attack inapplicable. 

In this section, the third variant of the 
15 modification of the scalar multiplication operation is 
described . 

The third variant consists in making random the 
representation of each of the points manipulated during 
the scalar multiplication method. In the case of the 
20 use of the "double and add" algorithm, the modified 
scalar multiplication method is the following one in 4 
steps. The method takes as an input a point P and an 
integer d. The integer d is denoted d=(d(t),d(t- 
1) ,...,d(0) ) , where (d (t) , d (t-1 ),..., d ( 0 ) ) is the binary 
25 representation of d, with d(t) the most significant bit 
and d(0) the least significant bit. The algorithm 
returns the point Q=d.P as an output. 

This third variant is executed in three steps: 
1) Initialising the point Q with the point P; 
30 2) For i ranging from t-2 to 0, executing: 
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2a) Replacing Q with 2Q using the method Do' ; 

2b) If d(i)=l, replacing Q with Q+P using the 
method Ad' ; 

3) Returning Q. 
5 More generally, the method of the third variant 

described above applies to the scalar multiplication 
operation whatever the method (hereinafter denoted A) 
used for performing the calculation of the scalar 
multiplication. The method A uses the previously 
10 defined operations Do and Ad. 

The third variant of the countermeasure consists 
of replacing all the operations Do with Do' and Ad with 
Ad' . 

The third variant therefore ensures that the 

15 intermediate variables manipulated during the scalar 
multiplication operation are random. The advantage of 
the third variant compared with the second variant is 
increased security against DPA attacks on the 
intermediate operations of the scalar multiplication 

20 method. In particular, the third variant makes the 
previously described DPA attack inapplicable. 

In this section the fourth variant of 
modification of the scalar multiplication operation is 
described. The fourth variant consists in making 

25 random the representation of each of the points 
manipulated during the scalar multiplication method. 
The fourth variant is a modification of the third 
variant through the use of a counter, the said counter 
making it possible to determine the steps of the scalar 

30 multiplication algorithm for which the representation 
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of a point is made random. For this purpose a security 
parameter T is defined. In practice T=5 can be taken. 
In the case of the use of the "double and add" 
algorithm, the modified scalar multiplication method is 
the following one in 4 steps. The method takes as an 
input a point P and an integer d. 

The integer d is denoted d= (d ( t) , d ( t-1 ),..., d ( 0 )) , 
where (d ( t ) , d ( t-1) , d ( 0) ) is the binary representation 
of d, with d(t) the most significant bit and d(0) the 
least significant bit. The algorithm returns as an 
output the point Q=d.P. 

The fourth variant is executed in three steps: 

1) Initialising the point Q with the point P. 

2) Initialising the counter co to the value T. 

3) For i ranging from t-1 to 0, executing: 

3a) Replacing Q with 2Q using the method Do if 
co is different from 0, otherwise using the method Do' . 

3b) If d(i)=l, replacing Q with Q+P using the 
method Ad. 

3c) If co=0 then reinitialising the counter co 
to the value T. 

3d) Decrementing the counter co . 
3) Returning Q. 

More generally, the method of the third variant 
described above applies to the scalar multiplication 
operation whatever the method (hereinafter denoted A) 
used for effecting the calculation of the scalar 
multiplication. The method A uses the previously 

defined operations Do and Ad. 
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The variant of the third countermeasure consists 
in initialising a counter co to the value T. The 
operation Do is replaced by the operation Do' if the 
value of the counter is 0. 
5 After each execution of the operations Do or Do' , 

the counter is reinitialised to the value T if it has 
reached the value 0; it is then decremented. 

The fourth variant therefore ensures that the 
intermediate variables manipulated during the scalar 
10 multiplication operation are random. The advantage of 
the fourth variant compared with the third variant is a 
greater speed of execution. The fourth variant makes 
the previously described DPA attack inapplicable. 

The application of one of the four variants 
15 described above therefore makes it possible to protect 
any cryptographic algorithm based on elliptical curves 
against the previously described DPA attack. 
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CLAIMS 

1. A countermeasure method in an electronic 
component implementing an elliptical curve type public 
key encryption algorithm using the representation of 
the points of the said elliptical curve in projective 
coordinates, consisting of representing a point P on 
the elliptical curve by the coordinates (X, Y, Z) such 
that x=X/Z and y=Y/Z^3, x and y being the coordinates 
of the point on the elliptical curve in terms of affine 
coordinates, the said curve comprising n elements and 
being defined on a finite field GF(p), p being a prime 
number, the said curve having the equation 
y /s 2=x A 3+a*x+b, or defined on a finite field GF(2 A n), 
the said curve having the equation y A 2+x*y=x A 3+a*x A 2+b, 
where a and b are integer parameters fixed at the 
start, the said method choosing a random integer 
representative from amongst n possible elements in 
terms of projective coordinates of the elliptical curve 
and consisting of a modification of the operations of 
addition of points, doubling of the said points and/or 
a modification of the scalar multiplication operation, 
characterised in that the countermeasure applies 
whatever the method or algorithm, hereinafter denoted 
A, used for performing the point doubling operation, 
the method A being replaced by the method A' in three 
steps, using an input defined by a point P=(X1,Y1,Z1) 
represented in terms of projective coordinates and an 
output defined by point Q=(X2,Y2,Z2) represented in 
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terms of projective coordinates such that Q=2.P, of the 
elliptical curve, the said steps being: 

1) Drawing at random an integer X such that 

0<A,<p; 

2) Calculating X' 1=V2 *X1, Y' 1=A. A 3*Y1 and 
Z'1=A,*Z1, X'l, Y'l and Z' 1 defining the coordinates of 
the point P' = (X' 1, Y' 1, Z' 1) ; 

3) Calculating Q=2*P' by means of the algorithm 

A. 

2. A countermeasure method according to Claim 1, 
characterised in that the point doubling algorithm, or 
operations of doubling points on an elliptical curve 
defined on the said finite field GF(p), is effected in 
eight steps: 



1) 


Drawing 


at random an 


integer A, such that 


2) 


Calculate 


X'1=X A 2*X1, Y' 


1=X A 3*Y1 and Z'l=a,*Zl; 


3) 


Calculate 


M=3*X' l A 2+a*Z' 


1 A 4; 


4) 


Calculate 


Z2=2*Y' 1*Z' 1; 




5) 


Calculate 


S=4*X' 1*Y' 1 A 2; 




6) 


Calculate 


X2=M /V 2-2*S; 




7) 


Calculate 


T=8*Y' 1 A 4; 




8) 


Calculate 


Y2=M* (S-X2) -T. 




3. 


A countermeasure method 


according to Claim 1, 



characterised in that more generally the countermeasure 
method applies whatever the method denoted hereinafter 
A used for performing the points addition operation on 
an elliptical curve defined on the said finite field 
GF(p) is effected in five steps: 



32 



1) Drawing at random a non-zero integer X of 
GF(2 A n) ; 

2) Replacing XO with A, A 2*X0, YO with ?t A 3*Y0 and 
ZO with A*Z0; 

3) Drawing at random a non-zero integer \x of 
GF ( 2 A n ) ; 

4) Replacing XI with n A 2*Xl, Yl with |a A 3*Yl and 
Zl with |U*Z1; 

5) Calculating R=P+Q by means of algorithm A. 

4. A countermeasure method according to Claim 1, 
characterised in that the modification of the point 
addition algorithm for an elliptical curve defined on 
the finite field GF(p), where p is a prime number, is 
as follows: the projective coordinates of the point 
R=(X2,Y2,Z2) such that R=P+Q with P=(X0,Y0,Z0) and 
Q= (XI, Yl, Zl) are calculated by the following method in 
16 steps, in each of the steps the calculations being 
effected modulo p: 

1) Drawing at random an integer X belonging to 
the finite field GF(p) such that 0<A.<p; 

2) Replacing XO with A. A 2*X0, YO with ?i A 3*Y0 and 
ZO with A*Z0; 

3) Drawing at random an integer u belonging such 
that 0<jn<p; 

4) Replacing XI with u. A 2*Xl, Yl with p, A 3*Yl and 
Zl with |U*Z1; 

5) Calculate U0=X0*Z1 A 2; 

6) Calculate S0=Y0*Z1 A 3; 
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7) Calculate U1=X1*Z0 A 2; 

8) Calculate S1=Y1*Z0 A 3; 

9) Calculate W=U0-U1; 

10) Calculate R=S0-S1; 

11) Calculate T=U0+U1; 

12) Calculate M=S0+S1; 

13) Calculate Z2=Z0*Z1*W; 

14) Calculate X2=R A 2-T*W A 2 ; 

15) Calculate V=T*W A 2-2*X2 ; 

16) Calculate 2*Y2=V*R-M*W A 3 . 

5. A countermeasure method according to Claim 1, 
characterised in that, more generally, the modification 
of the point addition algorithm for an elliptical curve 
defined on the finite field GF(2 A n), where n is a prime 
number, is as follows: the projective coordinates of 
the point P=(X1,Y1,Z1) such that R=P+Q and Q=(X2,Y2,Z2) 
are calculated by the following method in 3 steps, in 
each of the steps the calculations being carried out 
modulo p: 

1) Drawing at random a non-zero element X of 
GF(2 A n) ; 

2) Calculating X'1=X A 2*X1, Y'1=X A 3*Y1 and 
Z'1=A*Z1, X'l, Y' 1 and Z'l defining the coordinates of 
the point P' = (X' 1 , Y' 1, 1' 1) ; 

3) Calculating Q=2.P' by means of the algorithm 

A. 

6. A countermeasure method according to Claim 1, 
characterised in that the countermeasure method 
consists of a modification of the previous method, the 
new point doubling method for an elliptical curve being 
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defined on the finite field GF(2 A n), and consists of 
the following 6 steps: 

1) Drawing at random a non-zero element X of 
GF(2 A n) ; 

2) Calculate X'1=A, A 2*X1, Y' 1=A. A 3 * Yl , Z'1=A*Z1; 

3) Calculate Z2=X' 1*Z ' 1 A 2 ; 

4) Calculate X2= (X' l+c*Z' 1 A 2 ) A 4 ; 

5) Calculate U=Z2+X' 1 A 2+Y' 1*Z' 1 ; 

6) Calculate Y2=X' 1 A 4 *Z2+U*X2 . 

7. A countermeasure method according to Claim 1, 
characterised in that, more generally, the modification 
of the point addition algorithm for an elliptical curve 
defined on the finite field GF(2 A n), where n is a prime 
number, is as follows: the projective coordinates of 
the point P=(X0,Y0,Z0) and Q=(X1,Y1,Z2) at the input 
and R=(X2,Y2,Z2) are calculated by the following method 
in 5 steps, in each of the steps the calculations being 
carried out modulo: 

1) Drawing at random a non-zero element X of 
GF(2 A n) ; 

2) Replacing XO with X A 2*X0, YO with A, A 3*Y0 and 
ZO with A*Z0; 

3) Drawing at random a non-zero element u. of 
GF(2 A n) ; 

4) Replacing XI with |u A 2*Xl, Yl with u. A 3*Yl and 
Zl with n*Zl; 

5) Calculating R=P+Q using the algorithm A. 

8. A countermeasure method according to Claim 1, 
characterised in that the countermeasure method 
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consists of a modification of the point addition method 
for an elliptical curve defined on the finite field 
GF ( 2 A n) and consists of the following 16 steps: 

1) Drawing at random a non-zero element A, of 
GF(2 A n) ; 

2) Replacing XO with A A 2*X0, YO with A, A 3*Y0 and 
ZO with A*Z0; 

3) Drawing at random a non-zero element jj. of 
GF(2 A n) ; 

4) Replacing XI with fx A 2*Xl, Yl with |u A 3*Yl and 
Zl with u*Zl; 

5) Calculate U0=X0*Zl A 2; 

6) Calculate S0=Y0*Z1 A 3; 

7) Calculate U1=X1*Z0 A 2; 

8) Calculate S1=Y1*Z0 A 3; 

9) Calculate W=U0+U1; 

10) Calculate R=S0+S1; 

11) Calculate L=Z0*W; 

12) Calculate V=R*X1+L*Y1; 

13) Calculate Z2=L*Z1; 

14) Calculate T=R+Z2; 

15) Calculate X2=a*Z2 A 2+T*R+W A 3 ; 

16) Calculate Y2=T*X2+V*L A 2 . 

9. A countermeasure method according to Claim 1, 
characterised in that the first variant of a 
modification of the scalar multiplication operation 
consists of making random the representation of a point 
at the start of the calculation method by the use of 
the "double and add" algorithm, the modified method of 
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scalar multiplication is as follows in 5 steps, taking 
as an input a point P and an integer d, the integer d 
being denoted d= (d (t ), d (t-1 ),..., d ( 0 )) , where (d(t),d(t- 
l),...,d(0)) is the binary representation of d, with d(t) 
the most significant bit and d(0) the least significant 
bit, the algorithm returning as an output the point 
Q=d.P, the method Do being the points doubling method, 
the method Do' being the modified points doubling 
method according to any one of the preceding claims, 
this first variant being executed in five steps: 

1) Initialising the point Q with the value P; 

2) Replacing Q with 2.Q using the method Do' ; 

3) If d(t-l)=l replacing Q with Q+P using the 
method Ad; 

4) For i ranging from t-2 to 0 executing: 
4a) Replacing Q with 2Q; 

4b) If d<i)=l, replacing Q with Q+P; 

5) Returning Q. 

10 . A countermeasure method according to Claim 
1, characterised in that the second variant of the 
scalar multiplication operation consists in making 
random the representation of a point at the start of 
the calculation method and at the end of the 
calculation method, this in the case of the use of the 
"double and add" algorithm, 

the modified scalar multiplication method being 
the following one in 7 steps, taking as an input a 
point P and an integer d, the integer d being denoted 
d= (d(t) ,d(t-l) ,...,d(0) ) , where (d (t) , d (t-1 ),..., d (0) ) is 
the binary representation of d, with d(t) the most 
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significant bit and d(0) the least significant bit, the 
algorithm returning as an output the point Q=d.P, the 
said second variant being executed in seven steps: 

1) Initialising the point Q with the value P; 

2) Replacing Q with 2.Q using the method Do'; 

3) If d(t-l)=l, replacing Q with Q+P using the 
method Ad; 

4) For i ranging from t-2 to 1, executing: 
4a) Replacing Q with 2Q; 

4b) If d(i)=l, replacing Q with Q+P; 

5) Replacing Q with 2.Q using the method Do' ; 

6) If d(0)=l, replacing Q with Q+P using the 
method Ad; 

7) Returning Q. 

11. A countermeasure method according to Claim 
1, characterised in that the third variant of the 
scalar multiplication operation is executed in three 
steps : 

1) Initialising the point Q with the point P; 

2) For i ranging from t-2 to 0, executing: 
2a) Replacing Q with 2Q using the method Do' ; 

2b) If d(i)=l, replacing Q with Q+P using the 
method Ad' , Ad' being the method of addition of the 
modified points according to the preceding claims; 

3) Returning Q. 

12. A countermeasure method according to Claim 
1, characterised in that the fourth variant of the 
scalar multiplication operation is executed in three 
steps : 

1) Initialising the point Q with the point P. 
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2) Initialising the counter co to the value T. 

3) For i ranging from t-1 to 0, executing: 

3a) Replacing Q with 2Q using the method Do if 
co is different from 0, otherwise using the method Do' . 

3b) If d(i)=l, replacing Q with Q+P using the 
method Ad. 

3c) If co=0 then reinitialising the counter co 
to the value T. 

3d) Decrementing the counter co . 
3) Returning Q. 

13. An electronic component using the method 
according to any one of the preceding claims, 
characterised in that it can be a smart card. 
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FRANCE 


99/03921 


March 26, 1999 


g]Yes QNo 








□Yes rjNo 








□Yes QNo 








□Yes QNo 








□Yes QNo 



I hereby claim the benefit under Title 35, United States Code § 1 19(e) of any United States provisional application(s) listed below. 



(APPLICATION NUMBER) (FILING DATE) 



(APPLICATION NUMBER) (FILING DATE) 
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I hereby claim the benefit under Title 35, United States Code, § 120 of any United States applications(s) or International (PCT) 
Application(s) designating the United States of America that is/are listed below and, insofar as the subject matter of each of the 
claims of this application is not disclosed in that/those prior application(s) in the manner provided by the first paragraph of Title 



35, United States Code, § 1 12, 1 acknowledge the duty to disclose to the U.S. Patent and Trademark Office all information known 
to me to be material to the patentability as defined in Title 37, Code of Federal Regulations § 1.56, which became available 
between the filing date of the prior application(s) and the national or international filing date of this application: 



PRIOR U.S. APPLICATIONS OR INTERNATIONAL (PCT) APPLICATIONS DESIGNATING THE U.S. FOR BENEFIT UNDER 35 U.S.C. § 120: 



U.S. APPLICATIONS 


STATUS (check one) 


U.S. APPLICATION NUMBER 


U.S. FILING DATE 


PATENTED 


PENDING 








□ 


□ 


□ 






















PCT APPLICATIONS DESIGNATING THE U.S. 








PCT APPLICATION NO. 


PCT FILING DATE 


U.S. APPLICATION 
NUMBERS ASSIGNED (if any) 








PCT/FR00/00603 


March 13,2000 



































I Hereby appoint the following attorneys and agent(s) to prosecute said application and to transact all business in the U.S. Patent and 
Tlademark Office connected therewith and to file, prosecute and to transact all business in connection with international applications 
deleted to said invention: 



IWilKarn L. Mathis 


X7,337_ 


R. Danny Huntington 


2Z903^. 


Huberts. Swecker 


19,885 


Eric H. Weisblatt 


3O505- 


jstaton N. Mandros 




James W. Peterson 


26,057 


jBcnton S. Duffett, Jr. 


22,030 


Teresa Stanek Rea 


2M2Z." 


^Sforman H. Stepno 




Robert E. Krebs 


25,_885_^ 


EEbnald L. Grudziecki 




William C. Rowland 




sErederick G. Michaud, Jr. 


26,003 


T. Gene Dillahunty 




"Alan E. Kopecki 




Patrick C. Keane 


3.2,858 _ 


Regis E. Slutter 


26,999 


B. Jefferson Boggs, Jr. 


32,344 , 


Samuel C. Miller, III 


JL3J0~ 


William H. Benz 




Robert G. Mukai 


_JL53JL___ 


Peter K. Skiff 


31,917 


George A. Hovanec, Jr. 


_2JL223 


Richard J. McGrath 


29J35__ 


James A. LaBarre 




Matthew L. Schneider 


32J_14 


E. Joseph Gess 


28,510 


Michael G. Savage 


32,596 



Gerald F. Swiss 
Charles F. Wieland III 
Bruce T. Wieder 
Todd R. Walters 
Ronni S. Jillions 
Harold R. Brown III 
Allen R. Baum 
Steven M. duBois 
Brian P. O'Shaughnessy 
Kenneth B. Le filer 
Fred W. Hathaway 

mini 

21839 



Address all correspondence to: James A. LaBarre 

Burns, Doane, Swecker & Mathis, L.L.P. 

P.O. Box 1404 

Alexandria, Virginia 22313-1404 

illinium ii 

21839 

Address all telephone calls to: James A. LaBarre at (703) 836-6620. 



I hereby declare that all statements made herein of my own knowledge are true and that all statements made on information and 
belief are believed to be true; and further that these statements were made with the knowledge that willful false statements and the 
like so made are punishable by fine or imprisonment, or both, under Section 1001 of Title 18 of the United States Code and that 
such willful false statements may jeopardize the validity of the application or any patent issued thereon. 
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FULL NAME OF SOLE OR FIRST INVENTOR 
CORON Jean-Sebastien 


1 SIGNATURE 








RESIDENCE (CITY & STATE/COUNTRY) ^ „ _bbJ>^ 

4 rue Leon Delagrange - 75015 PARIS -FRANCE ~ < 


CITIZ 
FRAN 


.NSHIP 

:e 


POST OFFICE ADDRESS (HOME ADDRESS) 

4 rue Leon Delagrange - 75015 PARIS - FRANCE 


FULL NAME OF SECOND JOINT INVENTOR, IF ANY 


1 SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


:nship 


POST OFFICE ADDRESS (HOME ADDRESS 


FULL NAME OF THIRD JOINT INVENTOR, IF ANY 


j SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


iNSHIP 


POST OFFICE ADDRESS (HOME ADDRESS 


FULL NAME OF FOURTH JOINT INVENTOR, IF ANY 


1 SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


ENSHIP 


POST OFFICE ADDRESS (HOME ADDRESS 


FULL NAME OF FIFTH JOINT INVENTOR, IF ANY 


1 SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


ENSHIP 


POST OFFICE ADDRESS (home address 


FlffiL NAME OF SIXTH JOINT INVENTOR, IF ANY 


1 SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


ENSHIP 


POST OFFICE ADDRESS (HOME ADDRESS 


FULL NAME OF SEVENTH JOINT INVENTOR, IF ANY 


| SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


ENSHIP 


POST OFFICE ADDRESS (HOME ADDRESS 


FULL NAME OF EIGHTH JOINT INVENTOR, IF ANY 


j SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 




CITIZ 


ENSHIP 


POST OFFICE ADDRESS (HOME ADDRESS 


FULL NAME OF NINTH JOINT INVENTOR, IF ANY 


1 SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/ COUNTRY) 


CITIZ 


ENSHIP 


POST OFFICE ADDRESS (HOME ADDRESS) 


FULL NAME OF TENTH JOINT INVENTOR, IF ANY 


| SIGNATURE 




DATE 


RESIDENCE (CITY & STATE/COUNTRY) 


CITIZ 


ENSHIP 


POST OFFICE ADDRESS (HOME ADDRESS 
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